diff options
| author | Laurent Bercot <ska-skaware@skarnet.org> | 2019-02-04 19:04:05 +0000 |
|---|---|---|
| committer | Laurent Bercot <ska-skaware@skarnet.org> | 2019-02-04 19:04:05 +0000 |
| commit | e910005b1a337093109af29c7bf21b32c343ab56 (patch) | |
| tree | 6b3326d5827211c99f858a56e2d4c86307e429d5 /doc/s6-ipcserver-access.html | |
| parent | fb6877e47d8a60b1e00ea55b2203589a43a610d0 (diff) | |
| download | s6-e910005b1a337093109af29c7bf21b32c343ab56.tar.xz | |
Revert -I, but add uid/self and gid/self to uidgid accessrules checking
Diffstat (limited to 'doc/s6-ipcserver-access.html')
| -rw-r--r-- | doc/s6-ipcserver-access.html | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/doc/s6-ipcserver-access.html b/doc/s6-ipcserver-access.html index 80b7503..b09d74a 100644 --- a/doc/s6-ipcserver-access.html +++ b/doc/s6-ipcserver-access.html @@ -30,7 +30,7 @@ the application program on the s6-ipcserver command line. <h2> Interface </h2> <pre> - s6-ipcserver-access [ -v <em>verbosity</em> ] [ -E | -e ] [ -l <em>localname</em> ] [ -I ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em> + s6-ipcserver-access [ -v <em>verbosity</em> ] [ -E | -e ] [ -l <em>localname</em> ] [ -i <em>rulesdir</em> | -x <em>rulesfile</em> ] <em>prog...</em> </pre> <ul> @@ -95,9 +95,6 @@ This is the default. </li> <li> <tt>-l <em>localname</em></tt> : use <em>localname</em> as the value for the ${PROTO}LOCALPATH environment variable, instead of looking it up via getsockname(). </li> - <li> <tt>-I</tt> : accept identity connections. If a client connects -with the same effective uid/gid pair as s6-ipcserver-access is running under, -then the ruleset check is bypassed and the connection is accepted. </li> <li> <tt>-i <em>rulesdir</em></tt> : check client credentials against a filesystem-based database in the <em>rulesdir</em> directory. </li> <li> <tt>-x <em>rulesfile</em></tt> : check client credentials @@ -141,7 +138,9 @@ them with the function. In other words, it tries to match: <ul> + <li> (if the client's effective uid is the same as <tt>s6-ipcserver-access</tt>'s effective uid) <tt>uid/self</tt> </li> <li> <tt>uid/</tt><em>uid</em> </li> + <li> (if the client's effective gid is the same as <tt>s6-ipcserver-access</tt>'s effective gid) <tt>gid/self</tt> </li> <li> <tt>gid/</tt><em>gid</em> </li> <li> <tt>uid/default</tt> </li> </ul> |